mathias

mathias commented on pull request mathias/hyperguild#156

2026-10-03 14:56:12 +00:00

fix(ingestion): brain/raw/ readers go through an os.Root; symlinks are inert (#153)

Gatekeeper verdict: BLOCK (head 8a91feb)

The read control itself held under execution: I found no way to read a file outside brain/raw/ through an entry under brain/raw/. The block is…

mathias commented on issue mathias/hyperguild#153

2026-10-03 14:54:17 +00:00

brain/raw/ readers follow symlinks (pending, promote); raw/ is writable via Syncthing

Decision (Mathias, 2026-10-03), item 2: accept the Syncthing write path to brain/raw/. No .stignore change and no symlink-sync change.

Reasoning: PR #156 makes symlinks inert for every…

mathias created pull request mathias/hyperguild#156

2026-10-03 14:47:54 +00:00

fix(ingestion): brain/raw/ readers go through an os.Root; symlinks are inert (#153)

mathias pushed to fix/raw-symlinks-153 at mathias/hyperguild

2026-10-03 14:47:44 +00:00

8a91feb02b fix(ingestion): every brain/raw/ reader goes through an os.Root; symlinks are inert

mathias created branch fix/raw-symlinks-153 in mathias/hyperguild

2026-10-03 14:47:44 +00:00

mathias pushed tag v0.19.1 to mathias/hyperguild

2026-10-03 14:42:44 +00:00

mathias commented on issue mathias/hyperguild#149

2026-10-03 14:42:28 +00:00

SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file

Deployed and verified live. #152 squash-merged as cfe3f24; CD rolled out ingestion:cfe3f24. Mathias approved the merge after the round-2 PASS.

mathias opened issue mathias/hyperguild#155

2026-10-03 14:42:23 +00:00

ingestion pins mcp-chassis v0.2.0: auth rejections aren't logged; REST metrics collapse to path="/"

mathias pushed to main at mathias/hyperguild

2026-10-03 14:38:08 +00:00

cfe3f24e25 fix(ingestion): authenticate the REST API; confine ingest paths to brain/raw/ (#149) (#152)

mathias closed issue mathias/hyperguild#149

2026-10-03 14:38:07 +00:00

SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file

mathias merged pull request mathias/hyperguild#152

2026-10-03 14:38:07 +00:00

fix(ingestion): authenticate the REST API; confine ingest paths to brain/raw/ (#149)

mathias opened issue mathias/hyperguild#154

2026-10-03 14:35:26 +00:00

Test that /mcp authenticates through the production router; close the re-wrap gap in main.go

mathias commented on issue mathias/hyperguild#149

2026-10-03 14:34:58 +00:00

SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file

Gatekeeper verdict, round 2: PASS (head b5c2271). No blocking findings remain.

I rebuilt the real ingestion/cmd/server binary from b5c2271, started it in an isolated env (invented sentinel…

mathias commented on pull request mathias/hyperguild#152

2026-10-03 14:34:57 +00:00

fix(ingestion): authenticate the REST API; confine ingest paths to brain/raw/ (#149)

Gatekeeper verdict, round 2: PASS (head b5c2271). No blocking findings remain.

I rebuilt the real ingestion/cmd/server binary from b5c2271, started it in an isolated env (invented sentinel…

mathias opened issue mathias/hyperguild#153

2026-10-03 14:32:32 +00:00

brain/raw/ readers follow symlinks (pending, promote); raw/ is writable via Syncthing

mathias pushed to fix/rest-auth-149 at mathias/hyperguild

2026-10-03 14:32:21 +00:00

b5c227179f fix(ingestion): close the PR #152 review findings on REST auth

mathias commented on issue mathias/tapir#37

2026-10-03 14:29:44 +00:00

Uploads: per-recording delete, nav link, and the unverified deploy facts (ingress body limit, spool volume)

Status after the production enablement (infra#520, 2026-10-03). Done: the dedicated spool (emptyDir at /spool, sizeLimit 6 Gi, TAPIR_UPLOAD_TMP_DIR=/spool); the ingress body limit was…

mathias pushed to main at mathias/tapir

2026-10-03 14:29:34 +00:00

df7bd459ed docs(adr): the ingress body-size item is resolved, and uploads are on in production (infra#520)

mathias commented on issue mathias/hyperguild#149

2026-10-03 14:28:09 +00:00

SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file

Gatekeeper verdict: BLOCK (head 21a53c4)

I reviewed this by running it, not by reading it. I built the real ingestion/cmd/server binary, started it in an isolated env (sentinel token, OAuth…

mathias commented on pull request mathias/hyperguild#152

2026-10-03 14:28:08 +00:00

fix(ingestion): authenticate the REST API; confine ingest paths to brain/raw/ (#149)

Gatekeeper verdict: BLOCK (head 21a53c4)

I reviewed this by running it, not by reading it. I built the real ingestion/cmd/server binary, started it in an isolated env (sentinel token, OAuth…